security/integrity/ima/ima_policy.c

   1 /*
   2  * Copyright (C) 2008 IBM Corporation
   3  * Author: Mimi Zohar <zohar@us.ibm.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation, version 2 of the License.
   8  *
   9  * ima_policy.c
  10  *      - initialize default measure policy rules
  11  *
  12  */
  13 #include <linux/module.h>
  14 #include <linux/list.h>
  15 #include <linux/fs.h>
  16 #include <linux/security.h>
  17 #include <linux/magic.h>
  18 #include <linux/parser.h>
  19 #include <linux/slab.h>
  20 #include <linux/rculist.h>
  21 #include <linux/genhd.h>
  22 #include <linux/seq_file.h>
  23
  24 #include "ima.h"
  25
  26 /* flags definitions */
  27 #define IMA_FUNC        0x0001
  28 #define IMA_MASK        0x0002
  29 #define IMA_FSMAGIC     0x0004
  30 #define IMA_UID         0x0008
  31 #define IMA_FOWNER      0x0010
  32 #define IMA_FSUUID      0x0020
  33 #define IMA_INMASK      0x0040
  34 #define IMA_EUID        0x0080
  35
  36 #define UNKNOWN         0
  37 #define MEASURE         0x0001  /* same as IMA_MEASURE */
  38 #define DONT_MEASURE    0x0002
  39 #define APPRAISE        0x0004  /* same as IMA_APPRAISE */
  40 #define DONT_APPRAISE   0x0008
  41 #define AUDIT           0x0040
  42
  43 int ima_policy_flag;
  44 static int temp_ima_appraise;
  45
  46 #define MAX_LSM_RULES 6
  47 enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
  48         LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
  49 };
  50
  51 enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
  52
  53 struct ima_rule_entry {
  54         struct list_head list;
  55         int action;
  56         unsigned int flags;
  57         enum ima_hooks func;
  58         int mask;
  59         unsigned long fsmagic;
  60         u8 fsuuid[16];
  61         kuid_t uid;
  62         kuid_t fowner;
  63         struct {
  64                 void *rule;     /* LSM file metadata specific */
  65                 void *args_p;   /* audit value */
  66                 int type;       /* audit type */
  67         } lsm[MAX_LSM_RULES];
  68 };
  69
  70 /*
  71  * Without LSM specific knowledge, the default policy can only be
  72  * written in terms of .action, .func, .mask, .fsmagic, .uid, and .fowner
  73  */
  74
  75 /*
  76  * The minimum rule set to allow for full TCB coverage.  Measures all files
  77  * opened or mmap for exec and everything read by root.  Dangerous because
  78  * normal users can easily run the machine out of memory simply building
  79  * and running executables.
  80  */
  81 static struct ima_rule_entry dont_measure_rules[] = {
  82         {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  83         {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
  84         {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
  85         {.action = DONT_MEASURE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
  86         {.action = DONT_MEASURE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
  87         {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
  88         {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
  89         {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
  90         {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
  91          .flags = IMA_FSMAGIC},
  92         {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
  93 };
  94
  95 static struct ima_rule_entry original_measurement_rules[] = {
  96         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
  97          .flags = IMA_FUNC | IMA_MASK},
  98         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
  99          .flags = IMA_FUNC | IMA_MASK},
 100         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 101          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
 102         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 103         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 104 };
 105
 106 static struct ima_rule_entry default_measurement_rules[] = {
 107         {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
 108          .flags = IMA_FUNC | IMA_MASK},
 109         {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
 110          .flags = IMA_FUNC | IMA_MASK},
 111         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 112          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
 113         {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
 114          .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
 115         {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
 116         {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
 117         {.action = MEASURE, .func = POLICY_CHECK, .flags = IMA_FUNC},
 118 };
 119
 120 static struct ima_rule_entry default_appraise_rules[] = {
 121         {.action = DONT_APPRAISE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 122         {.action = DONT_APPRAISE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
 123         {.action = DONT_APPRAISE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
 124         {.action = DONT_APPRAISE, .fsmagic = TMPFS_MAGIC, .flags = IMA_FSMAGIC},
 125         {.action = DONT_APPRAISE, .fsmagic = RAMFS_MAGIC, .flags = IMA_FSMAGIC},
 126         {.action = DONT_APPRAISE, .fsmagic = DEVPTS_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 127         {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
 128         {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
 129         {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
 130         {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
 131         {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
 132 #ifdef CONFIG_IMA_WRITE_POLICY
 133         {.action = APPRAISE, .func = POLICY_CHECK,
 134         .flags = IMA_FUNC | IMA_DIGSIG_REQUIRED},
 135 #endif
 136 #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
 137         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
 138 #else
 139         /* force signature */
 140         {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID,
 141          .flags = IMA_FOWNER | IMA_DIGSIG_REQUIRED},
 142 #endif
 143 };
 144
 145 static LIST_HEAD(ima_default_rules);
 146 static LIST_HEAD(ima_policy_rules);
 147 static LIST_HEAD(ima_temp_rules);
 148 static struct list_head *ima_rules;
 149
 150 static int ima_policy __initdata;
 151
 152 static int __init default_measure_policy_setup(char *str)
 153 {
 154         if (ima_policy)
 155                 return 1;
 156
 157         ima_policy = ORIGINAL_TCB;
 158         return 1;
 159 }
 160 __setup("ima_tcb", default_measure_policy_setup);
 161
 162 static int __init policy_setup(char *str)
 163 {
 164         if (ima_policy)
 165                 return 1;
 166
 167         if (strcmp(str, "tcb") == 0)
 168                 ima_policy = DEFAULT_TCB;
 169
 170         return 1;
 171 }
 172 __setup("ima_policy=", policy_setup);
 173
 174 static bool ima_use_appraise_tcb __initdata;
 175 static int __init default_appraise_policy_setup(char *str)
 176 {
 177         ima_use_appraise_tcb = 1;
 178         return 1;
 179 }
 180 __setup("ima_appraise_tcb", default_appraise_policy_setup);
 181
 182 /*
 183  * The LSM policy can be reloaded, leaving the IMA LSM based rules referring
 184  * to the old, stale LSM policy.  Update the IMA LSM based rules to reflect
 185  * the reloaded LSM policy.  We assume the rules still exist; and BUG_ON() if
 186  * they don't.
 187  */
 188 static void ima_lsm_update_rules(void)
 189 {
 190         struct ima_rule_entry *entry;
 191         int result;
 192         int i;
 193
 194         list_for_each_entry(entry, &ima_policy_rules, list) {
 195                 for (i = 0; i < MAX_LSM_RULES; i++) {
 196                         if (!entry->lsm[i].rule)
 197                                 continue;
 198                         result = security_filter_rule_init(entry->lsm[i].type,
 199                                                            Audit_equal,
 200                                                            entry->lsm[i].args_p,
 201                                                            &entry->lsm[i].rule);
 202                         BUG_ON(!entry->lsm[i].rule);
 203                 }
 204         }
 205 }
 206
 207 /**
 208  * ima_match_rules - determine whether an inode matches the measure rule.
 209  * @rule: a pointer to a rule
 210  * @inode: a pointer to an inode
 211  * @func: LIM hook identifier
 212  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 213  *
 214  * Returns true on rule match, false on failure.
 215  */
 216 static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
 217                             enum ima_hooks func, int mask)
 218 {
 219         struct task_struct *tsk = current;
 220         const struct cred *cred = current_cred();
 221         int i;
 222
 223         if ((rule->flags & IMA_FUNC) &&
 224             (rule->func != func && func != POST_SETATTR))
 225                 return false;
 226         if ((rule->flags & IMA_MASK) &&
 227             (rule->mask != mask && func != POST_SETATTR))
 228                 return false;
 229         if ((rule->flags & IMA_INMASK) &&
 230             (!(rule->mask & mask) && func != POST_SETATTR))
 231                 return false;
 232         if ((rule->flags & IMA_FSMAGIC)
 233             && rule->fsmagic != inode->i_sb->s_magic)
 234                 return false;
 235         if ((rule->flags & IMA_FSUUID) &&
 236             memcmp(rule->fsuuid, inode->i_sb->s_uuid, sizeof(rule->fsuuid)))
 237                 return false;
 238         if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
 239                 return false;
 240         if (rule->flags & IMA_EUID) {
 241                 if (has_capability_noaudit(current, CAP_SETUID)) {
 242                         if (!uid_eq(rule->uid, cred->euid)
 243                             && !uid_eq(rule->uid, cred->suid)
 244                             && !uid_eq(rule->uid, cred->uid))
 245                                 return false;
 246                 } else if (!uid_eq(rule->uid, cred->euid))
 247                         return false;
 248         }
 249
 250         if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
 251                 return false;
 252         for (i = 0; i < MAX_LSM_RULES; i++) {
 253                 int rc = 0;
 254                 u32 osid, sid;
 255                 int retried = 0;
 256
 257                 if (!rule->lsm[i].rule)
 258                         continue;
 259 retry:
 260                 switch (i) {
 261                 case LSM_OBJ_USER:
 262                 case LSM_OBJ_ROLE:
 263                 case LSM_OBJ_TYPE:
 264                         security_inode_getsecid(inode, &osid);
 265                         rc = security_filter_rule_match(osid,
 266                                                         rule->lsm[i].type,
 267                                                         Audit_equal,
 268                                                         rule->lsm[i].rule,
 269                                                         NULL);
 270                         break;
 271                 case LSM_SUBJ_USER:
 272                 case LSM_SUBJ_ROLE:
 273                 case LSM_SUBJ_TYPE:
 274                         security_task_getsecid(tsk, &sid);
 275                         rc = security_filter_rule_match(sid,
 276                                                         rule->lsm[i].type,
 277                                                         Audit_equal,
 278                                                         rule->lsm[i].rule,
 279                                                         NULL);
 280                 default:
 281                         break;
 282                 }
 283                 if ((rc < 0) && (!retried)) {
 284                         retried = 1;
 285                         ima_lsm_update_rules();
 286                         goto retry;
 287                 }
 288                 if (!rc)
 289                         return false;
 290         }
 291         return true;
 292 }
 293
 294 /*
 295  * In addition to knowing that we need to appraise the file in general,
 296  * we need to differentiate between calling hooks, for hook specific rules.
 297  */
 298 static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
 299 {
 300         if (!(rule->flags & IMA_FUNC))
 301                 return IMA_FILE_APPRAISE;
 302
 303         switch (func) {
 304         case MMAP_CHECK:
 305                 return IMA_MMAP_APPRAISE;
 306         case BPRM_CHECK:
 307                 return IMA_BPRM_APPRAISE;
 308         case FILE_CHECK:
 309         case POST_SETATTR:
 310                 return IMA_FILE_APPRAISE;
 311         case MODULE_CHECK ... MAX_CHECK - 1:
 312         default:
 313                 return IMA_READ_APPRAISE;
 314         }
 315 }
 316
 317 /**
 318  * ima_match_policy - decision based on LSM and other conditions
 319  * @inode: pointer to an inode for which the policy decision is being made
 320  * @func: IMA hook identifier
 321  * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
 322  *
 323  * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
 324  * conditions.
 325  *
 326  * Since the IMA policy may be updated multiple times we need to lock the
 327  * list when walking it.  Reads are many orders of magnitude more numerous
 328  * than writes so ima_match_policy() is classical RCU candidate.
 329  */
 330 int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask,
 331                      int flags)
 332 {
 333         struct ima_rule_entry *entry;
 334         int action = 0, actmask = flags | (flags << 1);
 335
 336         rcu_read_lock();
 337         list_for_each_entry_rcu(entry, ima_rules, list) {
 338
 339                 if (!(entry->action & actmask))
 340                         continue;
 341
 342                 if (!ima_match_rules(entry, inode, func, mask))
 343                         continue;
 344
 345                 action |= entry->flags & IMA_ACTION_FLAGS;
 346
 347                 action |= entry->action & IMA_DO_MASK;
 348                 if (entry->action & IMA_APPRAISE)
 349                         action |= get_subaction(entry, func);
 350
 351                 if (entry->action & IMA_DO_MASK)
 352                         actmask &= ~(entry->action | entry->action << 1);
 353                 else
 354                         actmask &= ~(entry->action | entry->action >> 1);
 355
 356                 if (!actmask)
 357                         break;
 358         }
 359         rcu_read_unlock();
 360
 361         return action;
 362 }
 363
 364 /*
 365  * Initialize the ima_policy_flag variable based on the currently
 366  * loaded policy.  Based on this flag, the decision to short circuit
 367  * out of a function or not call the function in the first place
 368  * can be made earlier.
 369  */
 370 void ima_update_policy_flag(void)
 371 {
 372         struct ima_rule_entry *entry;
 373
 374         list_for_each_entry(entry, ima_rules, list) {
 375                 if (entry->action & IMA_DO_MASK)
 376                         ima_policy_flag |= entry->action;
 377         }
 378
 379         ima_appraise |= temp_ima_appraise;
 380         if (!ima_appraise)
 381                 ima_policy_flag &= ~IMA_APPRAISE;
 382 }
 383
 384 /**
 385  * ima_init_policy - initialize the default measure rules.
 386  *
 387  * ima_rules points to either the ima_default_rules or the
 388  * the new ima_policy_rules.
 389  */
 390 void __init ima_init_policy(void)
 391 {
 392         int i, measure_entries, appraise_entries;
 393
 394         /* if !ima_policy set entries = 0 so we load NO default rules */
 395         measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
 396         appraise_entries = ima_use_appraise_tcb ?
 397                          ARRAY_SIZE(default_appraise_rules) : 0;
 398
 399         for (i = 0; i < measure_entries; i++)
 400                 list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
 401
 402         switch (ima_policy) {
 403         case ORIGINAL_TCB:
 404                 for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
 405                         list_add_tail(&original_measurement_rules[i].list,
 406                                       &ima_default_rules);
 407                 break;
 408         case DEFAULT_TCB:
 409                 for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
 410                         list_add_tail(&default_measurement_rules[i].list,
 411                                       &ima_default_rules);
 412         default:
 413                 break;
 414         }
 415
 416         for (i = 0; i < appraise_entries; i++) {
 417                 list_add_tail(&default_appraise_rules[i].list,
 418                               &ima_default_rules);
 419                 if (default_appraise_rules[i].func == POLICY_CHECK)
 420                         temp_ima_appraise |= IMA_APPRAISE_POLICY;
 421         }
 422
 423         ima_rules = &ima_default_rules;
 424         ima_update_policy_flag();
 425 }
 426
 427 /* Make sure we have a valid policy, at least containing some rules. */
 428 int ima_check_policy(void)
 429 {
 430         if (list_empty(&ima_temp_rules))
 431                 return -EINVAL;
 432         return 0;
 433 }
 434
 435 /**
 436  * ima_update_policy - update default_rules with new measure rules
 437  *
 438  * Called on file .release to update the default rules with a complete new
 439  * policy.  What we do here is to splice ima_policy_rules and ima_temp_rules so
 440  * they make a queue.  The policy may be updated multiple times and this is the
 441  * RCU updater.
 442  *
 443  * Policy rules are never deleted so ima_policy_flag gets zeroed only once when
 444  * we switch from the default policy to user defined.
 445  */
 446 void ima_update_policy(void)
 447 {
 448         struct list_head *first, *last, *policy;
 449
 450         /* append current policy with the new rules */
 451         first = (&ima_temp_rules)->next;
 452         last = (&ima_temp_rules)->prev;
 453         policy = &ima_policy_rules;
 454
 455         synchronize_rcu();
 456
 457         last->next = policy;
 458         rcu_assign_pointer(list_next_rcu(policy->prev), first);
 459         first->prev = policy->prev;
 460         policy->prev = last;
 461
 462         /* prepare for the next policy rules addition */
 463         INIT_LIST_HEAD(&ima_temp_rules);
 464
 465         if (ima_rules != policy) {
 466                 ima_policy_flag = 0;
 467                 ima_rules = policy;
 468         }
 469         ima_update_policy_flag();
 470 }
 471
 472 enum {
 473         Opt_err = -1,
 474         Opt_measure = 1, Opt_dont_measure,
 475         Opt_appraise, Opt_dont_appraise,
 476         Opt_audit,
 477         Opt_obj_user, Opt_obj_role, Opt_obj_type,
 478         Opt_subj_user, Opt_subj_role, Opt_subj_type,
 479         Opt_func, Opt_mask, Opt_fsmagic,
 480         Opt_fsuuid, Opt_uid, Opt_euid, Opt_fowner,
 481         Opt_appraise_type, Opt_permit_directio
 482 };
 483
 484 static match_table_t policy_tokens = {
 485         {Opt_measure, "measure"},
 486         {Opt_dont_measure, "dont_measure"},
 487         {Opt_appraise, "appraise"},
 488         {Opt_dont_appraise, "dont_appraise"},
 489         {Opt_audit, "audit"},
 490         {Opt_obj_user, "obj_user=%s"},
 491         {Opt_obj_role, "obj_role=%s"},
 492         {Opt_obj_type, "obj_type=%s"},
 493         {Opt_subj_user, "subj_user=%s"},
 494         {Opt_subj_role, "subj_role=%s"},
 495         {Opt_subj_type, "subj_type=%s"},
 496         {Opt_func, "func=%s"},
 497         {Opt_mask, "mask=%s"},
 498         {Opt_fsmagic, "fsmagic=%s"},
 499         {Opt_fsuuid, "fsuuid=%s"},
 500         {Opt_uid, "uid=%s"},
 501         {Opt_euid, "euid=%s"},
 502         {Opt_fowner, "fowner=%s"},
 503         {Opt_appraise_type, "appraise_type=%s"},
 504         {Opt_permit_directio, "permit_directio"},
 505         {Opt_err, NULL}
 506 };
 507
 508 static int ima_lsm_rule_init(struct ima_rule_entry *entry,
 509                              substring_t *args, int lsm_rule, int audit_type)
 510 {
 511         int result;
 512
 513         if (entry->lsm[lsm_rule].rule)
 514                 return -EINVAL;
 515
 516         entry->lsm[lsm_rule].args_p = match_strdup(args);
 517         if (!entry->lsm[lsm_rule].args_p)
 518                 return -ENOMEM;
 519
 520         entry->lsm[lsm_rule].type = audit_type;
 521         result = security_filter_rule_init(entry->lsm[lsm_rule].type,
 522                                            Audit_equal,
 523                                            entry->lsm[lsm_rule].args_p,
 524                                            &entry->lsm[lsm_rule].rule);
 525         if (!entry->lsm[lsm_rule].rule) {
 526                 kfree(entry->lsm[lsm_rule].args_p);
 527                 return -EINVAL;
 528         }
 529
 530         return result;
 531 }
 532
 533 static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
 534 {
 535         audit_log_format(ab, "%s=", key);
 536         audit_log_untrustedstring(ab, value);
 537         audit_log_format(ab, " ");
 538 }
 539
 540 static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
 541 {
 542         struct audit_buffer *ab;
 543         char *from;
 544         char *p;
 545         int result = 0;
 546
 547         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
 548
 549         entry->uid = INVALID_UID;
 550         entry->fowner = INVALID_UID;
 551         entry->action = UNKNOWN;
 552         while ((p = strsep(&rule, " \t")) != NULL) {
 553                 substring_t args[MAX_OPT_ARGS];
 554                 int token;
 555                 unsigned long lnum;
 556
 557                 if (result < 0)
 558                         break;
 559                 if ((*p == '\0') || (*p == ' ') || (*p == '\t'))
 560                         continue;
 561                 token = match_token(p, policy_tokens, args);
 562                 switch (token) {
 563                 case Opt_measure:
 564                         ima_log_string(ab, "action", "measure");
 565
 566                         if (entry->action != UNKNOWN)
 567                                 result = -EINVAL;
 568
 569                         entry->action = MEASURE;
 570                         break;
 571                 case Opt_dont_measure:
 572                         ima_log_string(ab, "action", "dont_measure");
 573
 574                         if (entry->action != UNKNOWN)
 575                                 result = -EINVAL;
 576
 577                         entry->action = DONT_MEASURE;
 578                         break;
 579                 case Opt_appraise:
 580                         ima_log_string(ab, "action", "appraise");
 581
 582                         if (entry->action != UNKNOWN)
 583                                 result = -EINVAL;
 584
 585                         entry->action = APPRAISE;
 586                         break;
 587                 case Opt_dont_appraise:
 588                         ima_log_string(ab, "action", "dont_appraise");
 589
 590                         if (entry->action != UNKNOWN)
 591                                 result = -EINVAL;
 592
 593                         entry->action = DONT_APPRAISE;
 594                         break;
 595                 case Opt_audit:
 596                         ima_log_string(ab, "action", "audit");
 597
 598                         if (entry->action != UNKNOWN)
 599                                 result = -EINVAL;
 600
 601                         entry->action = AUDIT;
 602                         break;
 603                 case Opt_func:
 604                         ima_log_string(ab, "func", args[0].from);
 605
 606                         if (entry->func)
 607                                 result = -EINVAL;
 608
 609                         if (strcmp(args[0].from, "FILE_CHECK") == 0)
 610                                 entry->func = FILE_CHECK;
 611                         /* PATH_CHECK is for backwards compat */
 612                         else if (strcmp(args[0].from, "PATH_CHECK") == 0)
 613                                 entry->func = FILE_CHECK;
 614                         else if (strcmp(args[0].from, "MODULE_CHECK") == 0)
 615                                 entry->func = MODULE_CHECK;
 616                         else if (strcmp(args[0].from, "FIRMWARE_CHECK") == 0)
 617                                 entry->func = FIRMWARE_CHECK;
 618                         else if ((strcmp(args[0].from, "FILE_MMAP") == 0)
 619                                 || (strcmp(args[0].from, "MMAP_CHECK") == 0))
 620                                 entry->func = MMAP_CHECK;
 621                         else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
 622                                 entry->func = BPRM_CHECK;
 623                         else if (strcmp(args[0].from, "KEXEC_KERNEL_CHECK") ==
 624                                  0)
 625                                 entry->func = KEXEC_KERNEL_CHECK;
 626                         else if (strcmp(args[0].from, "KEXEC_INITRAMFS_CHECK")
 627                                  == 0)
 628                                 entry->func = KEXEC_INITRAMFS_CHECK;
 629                         else if (strcmp(args[0].from, "POLICY_CHECK") == 0)
 630                                 entry->func = POLICY_CHECK;
 631                         else
 632                                 result = -EINVAL;
 633                         if (!result)
 634                                 entry->flags |= IMA_FUNC;
 635                         break;
 636                 case Opt_mask:
 637                         ima_log_string(ab, "mask", args[0].from);
 638
 639                         if (entry->mask)
 640                                 result = -EINVAL;
 641
 642                         from = args[0].from;
 643                         if (*from == '^')
 644                                 from++;
 645
 646                         if ((strcmp(from, "MAY_EXEC")) == 0)
 647                                 entry->mask = MAY_EXEC;
 648                         else if (strcmp(from, "MAY_WRITE") == 0)
 649                                 entry->mask = MAY_WRITE;
 650                         else if (strcmp(from, "MAY_READ") == 0)
 651                                 entry->mask = MAY_READ;
 652                         else if (strcmp(from, "MAY_APPEND") == 0)
 653                                 entry->mask = MAY_APPEND;
 654                         else
 655                                 result = -EINVAL;
 656                         if (!result)
 657                                 entry->flags |= (*args[0].from == '^')
 658                                      ? IMA_INMASK : IMA_MASK;
 659                         break;
 660                 case Opt_fsmagic:
 661                         ima_log_string(ab, "fsmagic", args[0].from);
 662
 663                         if (entry->fsmagic) {
 664                                 result = -EINVAL;
 665                                 break;
 666                         }
 667
 668                         result = kstrtoul(args[0].from, 16, &entry->fsmagic);
 669                         if (!result)
 670                                 entry->flags |= IMA_FSMAGIC;
 671                         break;
 672                 case Opt_fsuuid:
 673                         ima_log_string(ab, "fsuuid", args[0].from);
 674
 675                         if (memchr_inv(entry->fsuuid, 0x00,
 676                                        sizeof(entry->fsuuid))) {
 677                                 result = -EINVAL;
 678                                 break;
 679                         }
 680
 681                         result = blk_part_pack_uuid(args[0].from,
 682                                                     entry->fsuuid);
 683                         if (!result)
 684                                 entry->flags |= IMA_FSUUID;
 685                         break;
 686                 case Opt_uid:
 687                         ima_log_string(ab, "uid", args[0].from);
 688                 case Opt_euid:
 689                         if (token == Opt_euid)
 690                                 ima_log_string(ab, "euid", args[0].from);
 691
 692                         if (uid_valid(entry->uid)) {
 693                                 result = -EINVAL;
 694                                 break;
 695                         }
 696
 697                         result = kstrtoul(args[0].from, 10, &lnum);
 698                         if (!result) {
 699                                 entry->uid = make_kuid(current_user_ns(),
 700                                                        (uid_t) lnum);
 701                                 if (!uid_valid(entry->uid) ||
 702                                     (uid_t)lnum != lnum)
 703                                         result = -EINVAL;
 704                                 else
 705                                         entry->flags |= (token == Opt_uid)
 706                                             ? IMA_UID : IMA_EUID;
 707                         }
 708                         break;
 709                 case Opt_fowner:
 710                         ima_log_string(ab, "fowner", args[0].from);
 711
 712                         if (uid_valid(entry->fowner)) {
 713                                 result = -EINVAL;
 714                                 break;
 715                         }
 716
 717                         result = kstrtoul(args[0].from, 10, &lnum);
 718                         if (!result) {
 719                                 entry->fowner = make_kuid(current_user_ns(), (uid_t)lnum);
 720                                 if (!uid_valid(entry->fowner) || (((uid_t)lnum) != lnum))
 721                                         result = -EINVAL;
 722                                 else
 723                                         entry->flags |= IMA_FOWNER;
 724                         }
 725                         break;
 726                 case Opt_obj_user:
 727                         ima_log_string(ab, "obj_user", args[0].from);
 728                         result = ima_lsm_rule_init(entry, args,
 729                                                    LSM_OBJ_USER,
 730                                                    AUDIT_OBJ_USER);
 731                         break;
 732                 case Opt_obj_role:
 733                         ima_log_string(ab, "obj_role", args[0].from);
 734                         result = ima_lsm_rule_init(entry, args,
 735                                                    LSM_OBJ_ROLE,
 736                                                    AUDIT_OBJ_ROLE);
 737                         break;
 738                 case Opt_obj_type:
 739                         ima_log_string(ab, "obj_type", args[0].from);
 740                         result = ima_lsm_rule_init(entry, args,
 741                                                    LSM_OBJ_TYPE,
 742                                                    AUDIT_OBJ_TYPE);
 743                         break;
 744                 case Opt_subj_user:
 745                         ima_log_string(ab, "subj_user", args[0].from);
 746                         result = ima_lsm_rule_init(entry, args,
 747                                                    LSM_SUBJ_USER,
 748                                                    AUDIT_SUBJ_USER);
 749                         break;
 750                 case Opt_subj_role:
 751                         ima_log_string(ab, "subj_role", args[0].from);
 752                         result = ima_lsm_rule_init(entry, args,
 753                                                    LSM_SUBJ_ROLE,
 754                                                    AUDIT_SUBJ_ROLE);
 755                         break;
 756                 case Opt_subj_type:
 757                         ima_log_string(ab, "subj_type", args[0].from);
 758                         result = ima_lsm_rule_init(entry, args,
 759                                                    LSM_SUBJ_TYPE,
 760                                                    AUDIT_SUBJ_TYPE);
 761                         break;
 762                 case Opt_appraise_type:
 763                         if (entry->action != APPRAISE) {
 764                                 result = -EINVAL;
 765                                 break;
 766                         }
 767
 768                         ima_log_string(ab, "appraise_type", args[0].from);
 769                         if ((strcmp(args[0].from, "imasig")) == 0)
 770                                 entry->flags |= IMA_DIGSIG_REQUIRED;
 771                         else
 772                                 result = -EINVAL;
 773                         break;
 774                 case Opt_permit_directio:
 775                         entry->flags |= IMA_PERMIT_DIRECTIO;
 776                         break;
 777                 case Opt_err:
 778                         ima_log_string(ab, "UNKNOWN", p);
 779                         result = -EINVAL;
 780                         break;
 781                 }
 782         }
 783         if (!result && (entry->action == UNKNOWN))
 784                 result = -EINVAL;
 785         else if (entry->func == MODULE_CHECK)
 786                 temp_ima_appraise |= IMA_APPRAISE_MODULES;
 787         else if (entry->func == FIRMWARE_CHECK)
 788                 temp_ima_appraise |= IMA_APPRAISE_FIRMWARE;
 789         else if (entry->func == POLICY_CHECK)
 790                 temp_ima_appraise |= IMA_APPRAISE_POLICY;
 791         audit_log_format(ab, "res=%d", !result);
 792         audit_log_end(ab);
 793         return result;
 794 }
 795
 796 /**
 797  * ima_parse_add_rule - add a rule to ima_policy_rules
 798  * @rule - ima measurement policy rule
 799  *
 800  * Avoid locking by allowing just one writer at a time in ima_write_policy()
 801  * Returns the length of the rule parsed, an error code on failure
 802  */
 803 ssize_t ima_parse_add_rule(char *rule)
 804 {
 805         static const char op[] = "update_policy";
 806         char *p;
 807         struct ima_rule_entry *entry;
 808         ssize_t result, len;
 809         int audit_info = 0;
 810
 811         p = strsep(&rule, "\n");
 812         len = strlen(p) + 1;
 813         p += strspn(p, " \t");
 814
 815         if (*p == '#' || *p == '\0')
 816                 return len;
 817
 818         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
 819         if (!entry) {
 820                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 821                                     NULL, op, "-ENOMEM", -ENOMEM, audit_info);
 822                 return -ENOMEM;
 823         }
 824
 825         INIT_LIST_HEAD(&entry->list);
 826
 827         result = ima_parse_rule(p, entry);
 828         if (result) {
 829                 kfree(entry);
 830                 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
 831                                     NULL, op, "invalid-policy", result,
 832                                     audit_info);
 833                 return result;
 834         }
 835
 836         list_add_tail(&entry->list, &ima_temp_rules);
 837
 838         return len;
 839 }
 840
 841 /**
 842  * ima_delete_rules() called to cleanup invalid in-flight policy.
 843  * We don't need locking as we operate on the temp list, which is
 844  * different from the active one.  There is also only one user of
 845  * ima_delete_rules() at a time.
 846  */
 847 void ima_delete_rules(void)
 848 {
 849         struct ima_rule_entry *entry, *tmp;
 850         int i;
 851
 852         temp_ima_appraise = 0;
 853         list_for_each_entry_safe(entry, tmp, &ima_temp_rules, list) {
 854                 for (i = 0; i < MAX_LSM_RULES; i++)
 855                         kfree(entry->lsm[i].args_p);
 856
 857                 list_del(&entry->list);
 858                 kfree(entry);
 859         }
 860 }
 861
 862 #ifdef  CONFIG_IMA_READ_POLICY
 863 enum {
 864         mask_exec = 0, mask_write, mask_read, mask_append
 865 };
 866
 867 static char *mask_tokens[] = {
 868         "MAY_EXEC",
 869         "MAY_WRITE",
 870         "MAY_READ",
 871         "MAY_APPEND"
 872 };
 873
 874 enum {
 875         func_file = 0, func_mmap, func_bprm,
 876         func_module, func_firmware, func_post,
 877         func_kexec_kernel, func_kexec_initramfs,
 878         func_policy
 879 };
 880
 881 static char *func_tokens[] = {
 882         "FILE_CHECK",
 883         "MMAP_CHECK",
 884         "BPRM_CHECK",
 885         "MODULE_CHECK",
 886         "FIRMWARE_CHECK",
 887         "POST_SETATTR",
 888         "KEXEC_KERNEL_CHECK",
 889         "KEXEC_INITRAMFS_CHECK",
 890         "POLICY_CHECK"
 891 };
 892
 893 void *ima_policy_start(struct seq_file *m, loff_t *pos)
 894 {
 895         loff_t l = *pos;
 896         struct ima_rule_entry *entry;
 897
 898         rcu_read_lock();
 899         list_for_each_entry_rcu(entry, ima_rules, list) {
 900                 if (!l--) {
 901                         rcu_read_unlock();
 902                         return entry;
 903                 }
 904         }
 905         rcu_read_unlock();
 906         return NULL;
 907 }
 908
 909 void *ima_policy_next(struct seq_file *m, void *v, loff_t *pos)
 910 {
 911         struct ima_rule_entry *entry = v;
 912
 913         rcu_read_lock();
 914         entry = list_entry_rcu(entry->list.next, struct ima_rule_entry, list);
 915         rcu_read_unlock();
 916         (*pos)++;
 917
 918         return (&entry->list == ima_rules) ? NULL : entry;
 919 }
 920
 921 void ima_policy_stop(struct seq_file *m, void *v)
 922 {
 923 }
 924
 925 #define pt(token)       policy_tokens[token + Opt_err].pattern
 926 #define mt(token)       mask_tokens[token]
 927 #define ft(token)       func_tokens[token]
 928
 929 /*
 930  * policy_func_show - display the ima_hooks policy rule
 931  */
 932 static void policy_func_show(struct seq_file *m, enum ima_hooks func)
 933 {
 934         char tbuf[64] = {0,};
 935
 936         switch (func) {
 937         case FILE_CHECK:
 938                 seq_printf(m, pt(Opt_func), ft(func_file));
 939                 break;
 940         case MMAP_CHECK:
 941                 seq_printf(m, pt(Opt_func), ft(func_mmap));
 942                 break;
 943         case BPRM_CHECK:
 944                 seq_printf(m, pt(Opt_func), ft(func_bprm));
 945                 break;
 946         case MODULE_CHECK:
 947                 seq_printf(m, pt(Opt_func), ft(func_module));
 948                 break;
 949         case FIRMWARE_CHECK:
 950                 seq_printf(m, pt(Opt_func), ft(func_firmware));
 951                 break;
 952         case POST_SETATTR:
 953                 seq_printf(m, pt(Opt_func), ft(func_post));
 954                 break;
 955         case KEXEC_KERNEL_CHECK:
 956                 seq_printf(m, pt(Opt_func), ft(func_kexec_kernel));
 957                 break;
 958         case KEXEC_INITRAMFS_CHECK:
 959                 seq_printf(m, pt(Opt_func), ft(func_kexec_initramfs));
 960                 break;
 961         case POLICY_CHECK:
 962                 seq_printf(m, pt(Opt_func), ft(func_policy));
 963                 break;
 964         default:
 965                 snprintf(tbuf, sizeof(tbuf), "%d", func);
 966                 seq_printf(m, pt(Opt_func), tbuf);
 967                 break;
 968         }
 969         seq_puts(m, " ");
 970 }
 971
 972 int ima_policy_show(struct seq_file *m, void *v)
 973 {
 974         struct ima_rule_entry *entry = v;
 975         int i = 0;
 976         char tbuf[64] = {0,};
 977
 978         rcu_read_lock();
 979
 980         if (entry->action & MEASURE)
 981                 seq_puts(m, pt(Opt_measure));
 982         if (entry->action & DONT_MEASURE)
 983                 seq_puts(m, pt(Opt_dont_measure));
 984         if (entry->action & APPRAISE)
 985                 seq_puts(m, pt(Opt_appraise));
 986         if (entry->action & DONT_APPRAISE)
 987                 seq_puts(m, pt(Opt_dont_appraise));
 988         if (entry->action & AUDIT)
 989                 seq_puts(m, pt(Opt_audit));
 990
 991         seq_puts(m, " ");
 992
 993         if (entry->flags & IMA_FUNC)
 994                 policy_func_show(m, entry->func);
 995
 996         if (entry->flags & IMA_MASK) {
 997                 if (entry->mask & MAY_EXEC)
 998                         seq_printf(m, pt(Opt_mask), mt(mask_exec));
 999                 if (entry->mask & MAY_WRITE)
1000                         seq_printf(m, pt(Opt_mask), mt(mask_write));
1001                 if (entry->mask & MAY_READ)
1002                         seq_printf(m, pt(Opt_mask), mt(mask_read));
1003                 if (entry->mask & MAY_APPEND)
1004                         seq_printf(m, pt(Opt_mask), mt(mask_append));
1005                 seq_puts(m, " ");
1006         }
1007
1008         if (entry->flags & IMA_FSMAGIC) {
1009                 snprintf(tbuf, sizeof(tbuf), "0x%lx", entry->fsmagic);
1010                 seq_printf(m, pt(Opt_fsmagic), tbuf);
1011                 seq_puts(m, " ");
1012         }
1013
1014         if (entry->flags & IMA_FSUUID) {
1015                 seq_puts(m, "fsuuid=");
1016                 for (i = 0; i < ARRAY_SIZE(entry->fsuuid); ++i) {
1017                         switch (i) {
1018                         case 4:
1019                         case 6:
1020                         case 8:
1021                         case 10:
1022                                 seq_puts(m, "-");
1023                         }
1024                         seq_printf(m, "%x", entry->fsuuid[i]);
1025                 }
1026                 seq_puts(m, " ");
1027         }
1028
1029         if (entry->flags & IMA_UID) {
1030                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1031                 seq_printf(m, pt(Opt_uid), tbuf);
1032                 seq_puts(m, " ");
1033         }
1034
1035         if (entry->flags & IMA_EUID) {
1036                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->uid));
1037                 seq_printf(m, pt(Opt_euid), tbuf);
1038                 seq_puts(m, " ");
1039         }
1040
1041         if (entry->flags & IMA_FOWNER) {
1042                 snprintf(tbuf, sizeof(tbuf), "%d", __kuid_val(entry->fowner));
1043                 seq_printf(m, pt(Opt_fowner), tbuf);
1044                 seq_puts(m, " ");
1045         }
1046
1047         for (i = 0; i < MAX_LSM_RULES; i++) {
1048                 if (entry->lsm[i].rule) {
1049                         switch (i) {
1050                         case LSM_OBJ_USER:
1051                                 seq_printf(m, pt(Opt_obj_user),
1052                                            (char *)entry->lsm[i].args_p);
1053                                 break;
1054                         case LSM_OBJ_ROLE:
1055                                 seq_printf(m, pt(Opt_obj_role),
1056                                            (char *)entry->lsm[i].args_p);
1057                                 break;
1058                         case LSM_OBJ_TYPE:
1059                                 seq_printf(m, pt(Opt_obj_type),
1060                                            (char *)entry->lsm[i].args_p);
1061                                 break;
1062                         case LSM_SUBJ_USER:
1063                                 seq_printf(m, pt(Opt_subj_user),
1064                                            (char *)entry->lsm[i].args_p);
1065                                 break;
1066                         case LSM_SUBJ_ROLE:
1067                                 seq_printf(m, pt(Opt_subj_role),
1068                                            (char *)entry->lsm[i].args_p);
1069                                 break;
1070                         case LSM_SUBJ_TYPE:
1071                                 seq_printf(m, pt(Opt_subj_type),
1072                                            (char *)entry->lsm[i].args_p);
1073                                 break;
1074                         }
1075                 }
1076         }
1077         if (entry->flags & IMA_DIGSIG_REQUIRED)
1078                 seq_puts(m, "appraise_type=imasig ");
1079         if (entry->flags & IMA_PERMIT_DIRECTIO)
1080                 seq_puts(m, "permit_directio ");
1081         rcu_read_unlock();
1082         seq_puts(m, "\n");
1083         return 0;
1084 }
1085 #endif  /* CONFIG_IMA_READ_POLICY */